PT-2013-3514 · Wikimedia · Mediawiki

Ryan Lane · Published 2013-11-15 · Updated 2016-10-18 · CVE-2013-2032

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.6 MediaWiki versions 1.20.x prior to 1.20.5

Description The issue allows remote attackers to bypass the intended restrictions of an extension that only implements one of the password change blocks, specifically Special:PasswordReset or Special:ChangePassword.

Recommendations For MediaWiki versions prior to 1.19.6, update to version 1.19.6 or later. For MediaWiki versions 1.20.x prior to 1.20.5, update to version 1.20.5 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-2032

DSA-2891-1

Affected Products

Mediawiki

References · 15

• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2032 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201310-21.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2032 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html · Vendor Advisory
• https://bugzilla.wikimedia.org/show_bug.cgi?id=46590 · Patch
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-2032 · Security Note
• https://osv.dev/vulnerability/CVE-2013-2032 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-2032 · Security Note
• https://ubuntu.com/security/CVE-2013-2032 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2032 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2032 · Note
• http://secunia.com/advisories/55433 · Note